Search code examples
azure-active-directoryadal

Azure AD sign in permissions prompt

I have a Cordova app (setup as a native app in Azure) using the ADAL plugin for Apache Cordova to authenticate against my tenant. The permissions given to the native app in Azure Portal are simply:

  • Custom API (which is setup as a web app / API in the same tenant) with delegated permission to "Access custom API"

  • Azure Active Directory with delegated permission to "Sign in and read user profile"

When signing in for the first time, a permission prompt is shown.

My question is, is it expected that users will always see the prompt the first time they login even though the native app and web API are on the same tenant?

Mobile Azure AD Permissions screen

Solution

  • Yes, the first time any user signs into your app they will need to consent.

    If you are the tenant admin, you can consent for all users through admin consent. To do admin consent:

    1. Construct a request with &prompt=admin_consent.

    2. Navigate to the Azure Portal and go to App Registrations. Inside your app's blade, hit Grant Permissions.